[frgfm]

Summary

Node.js 18 is end of life and has no patched release for these issues. The 21 October 2026 security release fixes the eMudhra intermediate CA compromise and other Node.js vulnerabilities, with patches for Node.js 22, 24, and 26. Node.js 22.23.4 is the smallest patched major. This pins frontend CI and the Docker builder to 22.23.4, updates the node_modules cache key, and aligns the frontend docs.

Test plan

• npm ci passed on Node 22.23.4 / npm 10.9.9. npm reports 39 dependency audit findings in the unchanged lockfile.
• npm run build, npm run test:coverage -- --maxWorkers=2 --minWorkers=1, and npm run quality:ci passed. The build reports existing Browserslist age and bundle-size warnings.
• docker manifest inspect node:22.23.4-alpine passed. A full Docker build could not run because the Docker daemon is unavailable.

[frgfm]

Unfortunately, I just realized that there is no preview from Vercel or something else. So because this is changing the major version of Node, I think we should just run some short QA on the interface. There are no patched version on Node 18, so we can't afford to keep it. The closest version with a patch is version 22. This review should be a bit more thorough because of that major version change.